'Open MS Passport': MyUID Goes Beta

mastergoon writes "MyUID, which has been refered to as an "open MS Passport", has opened their doors to public beta testing. MyUID is a user database system, with the purpose of allowing virtually anyone to refer to its records using only HTTP or HTTPS. Many companies have unified login systems, like Yahoo! and Microsoft, but unlike MyUID, these databases cannot be put to use by any site. As of now there is an alpha release PHP4 connectivity API, which while not feature rich is in full working order. APIs should be available in your favourite language soon. You can view this example of a site remotely connecting to MyUID using the alpha API, and give a go at spoofing a login. They want the security of the login methods tested extensively before going production."

Problems

[pirodude]

From the TOS:

MyUID may revoke your account at any time, with or without a reason. If you have a subscribed account, you will not be refunded unless there are special circumstances.

All data in your account and messages you send and receive belong to MyUID. If you are looking for private transmissions you should be using encrypted e-mails.

--------------

The problems with sites like this is you don't know behind them, you don't know what makes them tick, you don't know who has access to your data. Until they allow me to encrypt my data with my own key and not allow anyone access to it (even to themselves) they're not going to see my business.

Wrong idea?

[Wrexs0ul]

I thought the whole problem with a centralized user system was exactly that it was a centralized user system. Doesn't matter who runs the ID server or how little information is stored on there; as soon as a centralized system exists it's the biggest, baddest target for attack out there with the highest consequences if it's broken into.

Site and software-dependent logins exist to protect us and our privacy, are we really willing to give those up so every site we use shares the login jdoe2004?

-Matt

Re:Wrong idea?

[LostCluster]

Furthermore, having a common UserID opens the door for sites that have fragments of your personal info to merge the pieces together to get a more complete picture.

Different from MS Passport?

[Endareth]

From my initial glance I really fail to see how this is really any better or different from MS Passport, even once it's ready for release. At least MS have the clout to have Passport used on more than just their own site, which is where the value really is. I'm also not to sure about the idea of a public Alpha test of this sort of technology. Seems a bit too early in the development cycle for it to be worthwhile. Getting the site slashdotted really only resuls in load testing, and they don't seem even close to that! And lets not forget the dumb name... how many [G|U|etc|UIDs do we need?

I think that some people are missing the point

[bersl2]

This is a story because they have proof of concept and a basic framework. This gives them attention; right now they need people to flesh out and test the system. A story on Slashdot is a great way to attract attention.

Now whether this project is ultimately useful is debatable.

Security?

[Ravenscall]

So, if I am reading the code right, it has basically no security whatsoever at this point. Wouldn't you want that in an alpha release?

Re:Are we sure this is for real?

[Anonymous Coward]

They have the most useless FAQ in recorded history...

Excuse me, but FAQ stands for "Frequently Asked Questions". Why do you expect there to be a lot of Frequently Asked Questions before there are any users to ask ANY questions?

Totally backwards

[torinth]

Why would I encourage users to aggregate all their personal data with some unknown startup?

The two options already available are both (at least marginally) better. Those options being: collecting minimal personal data at my site, or using a well-known and industry-monitored company as the aggregate.

If Yahoo! or Microsoft ran off with user data, at least they'd have something to lose. The same can't be said about MyUID. They could collect data for six months then run off and sell it to illegal immigrant smugglers. Who knows? They have no reputation, no history, and nothing to lose.

And I guess it's not so bad if they just stick with UID/Password and not personal data, but I'd still sooner wait for a reputable company who chose to open the API.

No totally

[Wrexs0ul]

Assumedly at this point the dog hasn't learned how to run script kiddie php exploits, otherwise your statement is correct.

It's a very good point: why would you? I could see you using your amazon.com account for one of their subsidiaries but a global, public identification system - regardless of data stored - just screams "hack me". What's worse: unless you're a company with big buying power (like Microsoft) you're not going to have invested in security necessary to protect those back-end servers from every HTTPD/mySQL/BIND? exploit out there meaning one lucky strike could potentially compromise every user on the system.

ouch.

-Matt

The problem...

[ameoba]

The problem with a system like this is that no matter how secure the underlying mechanism is, by making it so that any random site could possibly be using it for authentication, you have no idea who is legit & who is simply harvesting passwords.

With Passport, you know you're only dealing with big-name sites that are going to be linked from MSN.com, but here you have to wonder about the chain of trust.

But, LDAP is standard

[freeduke]

Ok, here comes a new API for login?? What about LDAP, isn't it secure, reliable and efficient? So Why do people have to reinvent the wheel everytime? It would be far more constructive to think about a way to integrate and interface a huge Internet distributed LDAP structure, and have a clear standard to implement the way it works...

Every website could have a root server for it's zone, registering new users' LDAP root server for authentification. They could also be third party LDAP server provider: ISP could be part of it, because they have go the login/pass associated to your connection, and they are already running LDAP servers.

Re:Wrong idea?

[mandalayx]

you're right, there are problems. and you have only hit on a few of them.

but realize that there is value for some folks in having a "universal" id system. why do you think that your SSN in the US is used so widely?

again, there are many problems, but there exist benefits too.

Re:FAQ (karma whoring)

[mandalayx]

perhaps you can ask the guy some questions and thus make them "frequently asked".

it seems like myuid hasn't seen enough light to get many questions in the first place.

Good SPAM

[Anonymous Coward]

Good for spamming: http://www.myuid.com/api/usercard.php?uid=1

Where's the security?

Markus Diersbock

Similar but different

[Wrexs0ul]

I'm not saying having this system wouldn't be simple. Consider though that your social security number is protected by the world's most powerful government with databases backed by thousands of staff whose sole job it is to ensure your number isn't stolen, yet even after all that identity theft still happens.

Now note that the providers of this or any comparable software simply cannot have that kind of backing, no fraud protection exists, and no working method of recovering your identity exists in the event your account is stolen. ...and that's only one more angle. The simplicity of auto-filling a couple form fields or keeping a common username/password can't compare with the overwhelming reality that if you or the account server is hacked you're toast. Nobody can offer similar protection to the US government and as such nobody could provide a service similar to SSN.

-Matt

Re:Problems

[javajawa]

Umm... if you want to encrypt with your own key, simply encypt it with your own key, and send through their transport encrypted...

Re:Are we sure this is for real?

[NanoGator]

"Why do you expect there to be a lot of Frequently Asked Questions before there are any users to ask ANY questions?"

Nobody's asking "what is it?"

Re:Similar but different

[Concerned Onlooker]

Consider though that your social security number is protected by the world's most powerful government with databases backed by thousands of staff whose sole job it is to ensure your number isn't stolen....

Well, sort of. I originally thought this as well, but then I quickly realized that most of my life I've filled in my SSN for every bank account, school form or medical questionnaire (to name a few). Your SSN is floating around all over the place, albeit in supposedly protected databases, but definitely not just being protected by the U.S. government.

Regarding MyUID, I'd rather not. If we're really supposed to be fighting the war on terror this would be a good place to start, by not centralizing so much information. Our power grid is a perfect example of a very vulnerable system. It doesn't seem like a good idea to emulate that in an information system if you're concerned about security.

Then again, it's not like state secrets would be held in this thing.

Re:Flying solo?

[SpootFinallyRegister]

Declare standards? Looks a little more like a piece of software written without a specification, much less a plan. At this point, after going through the website and glancing at code, I have a hard time rating this at anything above the beginning of an idea. Learning by working on things is good. Punching out code that is supposed to be a standard without writing at least something down about it first is a disaster.

From the FAQ...

[scrm]

Q: Can penguins fly?

A: No.

It is exactly this cocky, pointless geek-speak tone that stops these projects from gaining wide appeal with the less technically-inclined majority (and the business community in particular).

MyUID is a good idea, but like with so many open source projects run by CompSci students, if it's communicated like this, it won't get off the ground. When will these people learn?

The "My" prefix

[chickenwing]

Oh great, yet another thing with the "My" prefix. It has to be my #1 pet peeve in all of computing. It seems to be some kind of conspiracy by marketing people to force us all to use baby-talk to do anything with a computer.

Part of what bothers me about this phenomenon is that the word "My" is so selfish. I think a lot of the problems we are seeing on the Internet come from this selfishness (spam, viruses). "My" is so vague and relative. Why not give "My Computer" a name so more than one person can talk about it. "My" is usually not accurate. Computers and other resources are frequently shared.

I can't even begin to understand what "MySQL" is supposed to mean.

It seems like I'm alone on this one though. Everyone acts like I'm crazy when I try to discuss this. Anyone else out there feel this way about the word "My"? Maybe we can form some type of support group.

I don't get it

[njcoder]

National ID Card = Bad
Centralized authentication server for internet = Good

???????????

Unimpressive

[Bob Ince]

Well it's a good thing they're asking for security issues now rather than later, as the very first form field I found had a cross-site-scripting hole in. eg.

http://www.myuid.com/activate.php?email=fdgdfs%3Cs cript%3Ewindow.alert%28document.cookie%29%3B%3C%2F script%3E&code=boo

Maybe this is unrepresentative, but to me this just screams that MyUID haven't the first idea about webapp security and have no business developing something non-trivial like a single-sign-on system.

Free clue to PHP weenies: using magic quotes does not magically make your scripts secure. Cheers then.

Why NOT to use this...

[g_lightyear]

Part of the point behind Project Liberty, and one of the reasons that Passport hasn't worked, is that people aren't necessarily comfortable with the idea of a 'centralised' authentication system for the whole of the planet.

Passport assumes that everyone who wants centralised authentication is happy to have this information be held/known to Microsoft.

Liberty assumes that individuals are only interested in centralisation of information across closed user groups; either:

1) A single site, made up of multiple services, is interested in acting as a cohesive single whole (for example, a login that logs you in to the whole of OSDN, rather than just Slashdot), or

2) A single site is interested in sharing its identities with suppliers; for example, your corporate intranet allowing their absence management, healthcare, stock options, and other service providers to allow you to log into that corporate account using your intranet username/password.

They're completely and utterly different goals. Passport, arguably, has no value in a modern society where people know full well how these identities can be used; Liberty is a more realistic usage scenario, in a multitude of ways.

Liberty is still young; while the software is getting quite good, it's still a hassle to set up an Authentication Provider or turn your site into something that can support the liberty Service Provider API. This will change. It will work and survive solely because it doesn't need internet users, as a whole, to accept it. It works on the principle that people who have a need to unify their authentication systems, without writing crappy little APIs, can do so, in the small scale, at the level where it can actually see benefits.

registration requires cookies

[Eric Smith]

I don't mind that the reigstration requires cookies, but they should explicitly state that, especically if you try to submit a registration and the cookie is not present. Instead, they say something about the verification code not matching, and "Are you a robot?". Very unhelpful.

What is this?

[binkzz]

It's nothing more than a day's work. There is nothing to speak of, the passwords aren't stored encrypted and no intelligent thought seems to have been put into it. As someone else already mentioned, anyone can take the entire user database with personal information from the site (everything except the password). If I were to run a site using the MyUID, I could obtain users' MyUID passwords as they tried to log in on my site, giving full access to any user's account who logs in via my site. Outrageous!

Interestingly, it does say in the ToS:

MyUID will not give or sell your private account information or your password to anyone,

which seems a lie. But it goes on!

MyUID will supply any information we have about you to law enforcement officials if neccessary.

They'll rat on you even if not required by law. Yay!

In order to use MyUID, you must be a human over 13 Earth years old, living in a state where internet usage is legal.

... Wow..

The FAQ has two questions, one of which is 'Can penguins fly?'. I wouldn't hold my breath for this service to become very big.

Registered user #1 [myuid.com] is mastergoon, so this is just blatent self-advertising on slashdot.

DSA keys database?

[mikelang]

Maybe it would be better to standarize on cryptographic keys and enhance browser so as to automatically encrypt all connections to the chosen site. It acknowledges your identity, you can have different keys for different sites and you can have single password for store of crypto keys.

Re:Are we sure this is for real?

[nacturation]

They've implemented the old "hack first, design later" philosophy of software development. After something's hacked together, then it will be documented. Once the documentation has been produced, then it will go through a redesign because of unforseen problems and the API will be changed. As a result, older implementations will break.

On the plus side, at least they'll have first mover advantage no matter how buggy. Hey, it worked for Windows...

Re:Wrong idea?

[cwis42]

why do you think that your SSN in the US is used so widely?

This also has some security considerations. Why do you think it is illegal in France to use the SSN as an identifier?

waste of time

[Anonymous Coward]

this is just another project that will only attract blog webmasters.

businesses will not have one of their most important assets (Customer info) scattered around the web, god knows where!

maybe they should try to develop something really usefull like another GUI for linux.

Re:I haven't read the API but...

[David McBride]

Yes. Indeed, systems like Kerberos do exactly this. You can also do interesting things using X.509 keys and proxy certificates.

But to be honest, the real danger of any such system is that it makes the 'trusted central service' necessary for many of these large-scale authentication systems a massively large target.

Imagine: a ubiquitous authentication framework, used everywhere. Wonderful idea -- no more remembering all these damn passwords, everything is Just Secure.

Except that every black hat out there will be trying to crack that central server -- and much hilarity will ensue if they are successful in DDoSing it, or worse, obtain access to the keys within.

Which is one of the reasons why PGP, a decentralised public-key cryptosystem, is still quite popular - no central point of failure.